readme: escape html